Controlling a Pinball Machine Using Linux

Create a master hack by bringing the power of Linux to the ultimate electronic toy.

An old electronic pinball
machine is fascinating because it embodies complexity
just within the grasp of a jack-of-all-trades
hacker. You can learn how one works by visiting
the open-source repository known as the US Patent
and Trademark Office. The Bally Manufacturing
Corporation used a system built around its AS2518
Microprocessor Unit (MPU) described by US Patent
4,198,051 in more than 350,000 units from 1977 to
1985. Maybe you remember playing Evel
Knievel, KISS,
Mata Hari or
Space Invaders?

At the moment, you can buy most nonworking games for
less than $250. Many come with original documentation
that includes circuit schematics. Combined with
what you can learn from the patents and other
publications, plus your knowledge of PC hardware and
free, open-source software, you can hack together
something unique: a working, Web-enabled, classic
pinball machine that plays by your rules, running
your programs. You can do it legally, for less than
the cost of a replacement MPU board, with an old PC
and a stock Linux distribution like Fedora.

Reverse engineering the AS2518 MPU was the
subject of my Master's thesis in Industrial
Technology. Nonworking games often suffer the
same tragic design flaw we see on old computer
motherboards. Figure 1 shows the damage caused by a
leaking Ni-Cad battery that was soldered directly onto
the MPU. It ruins not only the electrical connections
in IC sockets, but also corrodes the wiring harnesses
joining the MPU to the rest of the system.

Figure 1. Corrosion on an AS2518 MPU Board

The other circuit boards are usually still
intact. When you start working on your game, check the
voltages at the test points to make sure. I chose to
neuter the flaky +5 VDC circuit altogether and use
the power supply from the PC. With the MPU removed,
you are left with four wire harnesses holding a total of 66
wires. To connect your PC to the pinball machine, you
will want to build an interface board with matching
header pins. The design goal is to produce the same
inputs and outputs on all of the wires that the original
MPU has. This may seem like an overwhelming task,
but remember, this is 1980s-era technology. I used an
iterative, divide, design, build and test approach
to reverse engineer one subsystem at a time.

What differentiates this project from the typical
emulator is that no reference is made to the
original programs encoded on the MPU firmware.
Instead, I employed a black box, or clean
room, method based on studying their function rather
than their internal structure. For me, it made sense
to interpret these 66 electrical connections in terms
of their purpose in a closed-loop process control
model. That is, each is either input, output, part of
a feedback circuit or part of the power supply. The
four main divisions of the pinball machine control
system are the solenoids, switch matrix, feature
lamps and digital displays. I intentionally left
out the digital displays for the first prototype,
which is why the apparatus uses the computer monitor
to show the scores. The analysis yielded the process
model shown in Figure 2.

Figure 2. Reverse-Engineered Process Model

The Hardware, Part I: the I/O Board

Facing a total of 11 inputs and 20 outputs,
and wanting room to grow, I decided to build a 48-port
digital I/O board. Designs can be found with a little
Web searching, and the components can be ordered from
Jameco. The Intel 8255 Parallel Peripheral Interface
(PPI) integrated circuit provides two 8-bit ports
and two 4-bit ports, each configurable as either
input or output. On my board, I hard-wired two of these
ICs to addresses 0x280-0x283 and 0x2A0-0x2A3. The
first three bytes of each are memory-mapped to the
aforementioned ports. The fourth byte is used to
control the port settings. I used a ten-foot piece
of 25-pair twisted pair cable to connect it to the
interface board via screw terminals. It's definitely
a hack, as Figure 3 illustrates. You may want to use
a 50-conductor SCSI cable and header pins.

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.